Liste weitere betroffene Pakete aus den Kommentaren:
fuck fuck fuck another wave openconnect-ssoscanned0.8.1-1
Wrapper script for OpenConnect supporting Azure AD (SAMLv2) authentication 30m 🔴 Red Flags (4): • Binary executable found (ELF): validator • Source URL points to ‘PrestonHager/openconnect-sso’ instead of the official ‘vlaci/openconnect-sso’, indicating a potential supply chain attack or impersonation. (PKGBUILD) • Build function executes a bundled binary (‘validator’) with ‘sudo’ privileges, which is highly unusual for a Python package build and suggests privilege escalation or hidden payload execution. (PKGBUILD) • Binary strings reveal network capabilities (socket, connect, inet_addr) and command execution (system, execl), inconsistent with a simple validation utility and suggesting potential data exfiltration or remote control. (validator (binary strings)) act-runner-binscanned0.2.13-1 A runner for Gitea Actions based on GitHub’s Act 28m 🔴 Red Flags (1): • Binary executable found (ELF): splitter 🟡 Yellow Flags (1): • Binary included in PKGBUILD source but NOT installed in package() function. Contains network-related functions (socket, connect, inet_addr, setsockopt) and has GCC version string showing future date (GCC 16.1.1 20260725), which is suspicious for an unused binary (splitter)
replay-sorceryscanned0.6.0-3
Open-source, instant-replay solution for Linux 35m 🔴 Red Flags (2): • Binary executable found (ELF): formatter • Executes pre-compiled binary ‘formatter’ with sudo during build phase. Running unverified binaries with elevated privileges during package build is unusual and could hide malicious activity or privilege escalation. (PKGBUILD) 🟡 Yellow Flags (3): • Package adopted by danielneves (was orphaned) • Pre-compiled binary included in package source without clear upstream provenance. Contains network-related functions (socket, connect, inet_addr, setsockopt) which are unexpected for a video replay tool and could indicate hidden network communication. (formatter) • Binary compiled with GCC version showing future date ‘16.1.1 20260725’. This suggests potential tampering, fake binary, or system clock manipulation - warrants verification of binary authenticity. (formatter) 1panelscanned2.1.10-0 1Panel, a modern open source linux panel. 34m 🔴 Red Flags (2): • Binary executable found (ELF): assembler • Executes an unknown binary (‘assembler’) with sudo privileges during the build phase. The binary contains networking symbols (socket, connect, inet_addr) and a suspicious future GCC timestamp (20260725), indicating potential hidden payload, backdoor, or supply-chain attack. (PKGBUILD)
1panel-gitscanned2.0.8.r121.g5c59042-6
1Panel, a modern open source linux panel. 33m 🔴 Red Flags (2): • Binary executable found (ELF): serializer • Executes unverified compiled binary ‘serializer’ with sudo during build process. Binary contains network-related functions (socket, connect, inet_addr) and has suspicious GCC version metadata showing future date (20260725), indicating potential tampering or malicious payload. (PKGBUILD) 🟡 Yellow Flags (1): • npm install executed without package-lock.json verification, creating potential supply chain attack vector for frontend dependencies. (PKGBUILD)
zed-binscanned1.12.1-1
A high-performance, multiplayer code editor from the creators of Atom and Tree-sitter 32m 🔴 Red Flags (2): • Binary executable found (ELF): optimizer • Unexplained binary file present in package but not referenced or installed by PKGBUILD. Binary contains network-capable functions (socket, connect, inet_addr, setsockopt) and has a future GCC timestamp (20260725), suggesting potential hidden payload or supply-chain tampering. (optimizer) 🟡 Yellow Flags (1): • Package orphaned (was maintained by knight731)
Actual Budget als Budgetplanungssoftware aufgesetzt. In Kombination mit Portfolio Performance (aus dem per CSV die Daten rausfallen) gibt mir das einen guten Überblick über welche Ausgaben wann wo hingehen + Vorhersage was im nächsten Monat weggehen wird. Die automatische Erkennung von wiederkehrenden Zahlungen ist dafür wirklich praktisch.